How Sage X3's function profiles, access codes, site/company access restrictions, Syracuse security, workflow rules and batch scheduling map onto D365's bottom-up role → duty → privilege → entry point hierarchy, Extensible Data Security, workflow engine, Power Automate and segregation of duties — and the licensing consequence of role design.
Part 1 of this domain settled the skeleton — legal entities, sites, warehouses and the financial dimensions that carry the rest of the enterprise structure. This chapter is about who is allowed to touch that skeleton, who must approve changes to it, and how you prove the controls are working.
D365 security composes four levels — permission, privilege, duty and role — above the entry points they secure. Unlike X3's function profile (where an administrator starts by naming a profile and adding functions to it), the D365 hierarchy is generated bottom-up from objects that already exist in the application.
An X3 function profile is the primary security object: it lists the function codes (roughly equivalent to transaction types or menu items) a user can access, the access level per function (creation, modification, deletion, consultation), and the site/company restrictions that limit the scope.
X3's function profile restricts users to specific sites and companies directly. D365 separates these concerns:
X3 workflow rules are configured within the X3 runtime, attached to object events (creation, modification, validation, deletion), and execute within the Folder context. They route approvals, send notifications, trigger escalations, and can invoke L4G scripts as action steps. D365 distributes these across three mechanisms:
X3's batch server schedules and executes recurring tasks within the X3 runtime — MRP calculations, period-end processing, report generation, data-export jobs, and housekeeping tasks. Each batch task is assigned to a server, a Folder, and an execution schedule; it runs under a designated batch user with its own function profile.
X3 programmes typically enforce segregation of duties through function-profile separation (ensuring one user cannot both create and approve a payment), workflow approval requirements (mandatory circuits preventing single-user completion of sensitive transactions), and access-code restrictions (preventing access to both creation and…
Every entry point a D365 role can reach carries a licence-entitlement tag against the named Dynamics 365 subscriptions — Finance, Supply Chain Management, Commerce, Human Resources, Team Members, and Activity — at the access level (Read or Write) the role grants.
Export active function profiles. Record function codes, access levels, site/company restrictions, and user counts per profile. Classify by business process. Group X3 functions by process area (procure-to-pay, order-to-cash, plan-to-produce, record-to-report) rather than by X3 module. Map to D365 standard duties.
Sage X3 concentrates access control, approval routing, and operational scheduling in a small number of tightly coupled constructs — the function profile, the workflow rule, and the batch server.